Your auditor needs one, it is not on any website, and the person who can send it is rarely the person you normally speak to. This is the request path, recordkeeper by recordkeeper.
We never host SOC 1 reports. They are restricted-use documents released under agreement, and republishing them would be both a breach and an obvious thing for a site like this to get wrong.
Maintained by the audit team at Ledgerline. Vendor neutral by policy: we never rank or recommend ourselves here.
A Type 1 report describes controls at a point in time. A Type 2 tests whether they actually operated over a period. Only the second gives an auditor something to rely on, so confirm which one you are being sent before the engagement plans around it.
Service organisations pick their own windows, commonly October to September. Where the report stops short of your plan year end, the gap is covered by a bridge letter from the service organisation confirming nothing material changed.
Every SOC 1 report lists controls the service organisation assumes YOU are performing, such as reviewing payroll files before they are transmitted or reconciling contributions. If you are not doing them, the report's assurance does not reach as far as it appears to.
A recordkeeper often relies on others for custody or trading, and its report either includes them or carves them out. If it carves out the piece your audit depends on, you need that organisation's report too.
The three facts that decide whether a SOC 1 arrives in time to be useful: how to ask, what period it covers, and whether a bridge letter will be issued for the gap. This is the emptiest table on the site, which reflects how little of it any recordkeeper puts in public.
A dot is not an answer, so here is every row in full. If you work at one of these recordkeepers and a row is wrong or missing, tell us and it goes in.
We have asked each of these and none of them publishes any of the rows on this page. They are listed rather than omitted because an empty row is a fact about the industry, and because somebody who works at one of them should be able to find their own name here.
Because the recordkeeper performs processes the plan depends on and the auditor cannot observe directly. A SOC 1 Type 2 report is an independent examination of those controls over a stated period, which lets the auditor rely on them rather than testing every transaction at source.
SOC 1 reports cover a fixed window that rarely matches a plan year. A bridge letter, sometimes called a gap letter, is the service organisation's statement that nothing material changed between the end of the report period and the end of your plan year. You need one whenever the report stops short of your year end.
Usually not. SOC 1 reports are restricted-use documents intended for the service organisation's customers and their auditors, and are normally released under an access or non-disclosure agreement. That is also why this site documents where to request one rather than hosting any.